>>>>Доброе утро ! Есть в локалке ftp сервер 192.168.1.1 и есть глобальный
>>>>адрес ххх.ххх.ххх.ххх. На киске пишу
>>>>
>>>>ip nat inside source static tcp 192.168.1.1 21 xxx.xxx.xxx.xxx 21 extendable
>>>>
>>>>Набираю в броузере ftp://xxx.xxx.xxx.xxx не работает ! Заране спасибо !
>>>>
>>>>P.S. Есть еще роут мап на внешнем интерфейсе
>>>>
>>>>route-map onloop deny 10
>>>> match ip address 5
>>>>!
>>>>route-map onloop permit 15
>>>> match ip address 108
>>>> set interface Loopback0 Ethernet0/0
>>>>
>>>>
>>>>access-list 5 permit 192.168.1.1 log
>>>>access-list 108 permit ip any 192.168.0.0 0.0.255.255
>>>>
>>>>Может сдесь что не так есть подозрение на 5 лист !
>>>
>>>
>>>в чем смысл роут мапов. отключи и проверь работу фтп
>>
>>Смысл в том что на киске снимается flow, и что бы в
>>DST я видел локальные адреса а не адрес трансляции.
>
>эт ясно.
>а 1.1 как понимаю обсчитывать не хочешь? Это один к одному как я понел! Нет не хочу !

>как без deny 10 работает?

вообще роутмап убирал, не работает !

>и надобы весь конф поглядеть..

>в пасивном режиме пробовал?
> Пробовал ! Не работает !
>>
>>Отключать пробовал,не работает !
>>
>>Совсем нечего понять немогу !

Current configuration:
!
! Last configuration change at 19:06:11 UTC Wed Apr 20 2005 by root
!
version 12.1
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname lacunacoil
!
logging buffered 4096 errors
aaa new-model
aaa authentication login default local
aaa authentication login CONSOLE none
aaa authorization exec default local if-authenticated
enable secret 5 $1$Bxt8$nw1uQl2c.knICWSOjMxQj/
enable password 7 09404F0A0C0B1611040508
!
username root password 7 130916111E020529242D24
!
!
!
!
ip subnet-zero
ip cef
ip name-server 195.34.32.10
ip name-server 195.34.32.116
!
ip audit notify log
ip audit po max-events 100
!
!
!
interface Loopback0
ip address 192.168.10.1 255.255.255.0
ip route-cache policy
ip route-cache flow
!
interface Ethernet0/0
ip address 192.168.1.1 255.255.255.0 secondary
ip address 192.168.0.3 255.255.255.0
ip nat inside
ip route-cache policy
ip route-cache flow
ip policy route-map office
!
interface Serial0/0
no ip address
shutdown
!
interface Ethernet0/1
ip address xx2.xx2.xx2.xx2 255.255.255.240 secondary
ip address xxx.xxx.xxx.xxx 255.255.255.248
ip access-group 105 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip route-cache policy
ip route-cache flow
ip policy route-map MAP
no keepalive
ntp disable
fair-queue
no cdp enable
!
interface Serial0/1
no ip address
shutdown
!
ip nat pool test xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.248
ip nat pool ISP2-pool xx2.xx2.xx2.xx2 xx2.xx2.xx2.xx2 prefix-length 28
ip nat pool karta xx1.xx1.xx1.xx1 xx1.xx1.xx1.xx1 prefix-length 29
ip nat pool isptest xx2.xx2.xx2.xx2 xx2.xx2.xx2.xx2 netmask 255.255.255.240
ip nat pool lan1 xx3.xx3.xx3.xx3 xx3.xx3.xx3.xx3 netmask 255.255.255.240
ip nat inside source list 3 pool karta overload
ip nat inside source list 4 pool isptest overload
ip nat inside source route-map lan1 pool lan1 overload
ip nat inside source static tcp 192.168.0.254 21 xxx.xxx.xxx.xxx 21 extendable
ip flow-export version 5 peer-as
ip flow-export destination xxx.xxx.xxx.xxx 3050
ip classless
ip route 0.0.0.0 0.0.0.0 xx6.xx6.xx6.xx6
ip route 0.0.0.0 0.0.0.0 xx5.xx5.xx5.xx5
no ip http server
!
!        
ip access-list extended ispone
deny   ip host 192.168.0.3 any
permit ip 192.168.0.0 0.0.0.255 any
ip access-list extended isptest
permit ip host 192.168.0.15 any
ip access-list extended isptwo
permit ip host 192.168.0.15 any
access-list 1 remark SNMP access
access-list 1 permit xxx.xxx.xxx.xxx
access-list 3 deny   192.168.0.15
access-list 3 permit 192.168.0.0 0.0.0.255
access-list 4 permit 192.168.0.15
access-list 4 permit 192.168.1.0 0.0.0.255
access-list 10 deny   217.67.187.40
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 11 deny   217.67.187.40
access-list 104 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 104 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 105 deny   ip host 0.0.0.0 any
access-list 105 deny   ip 127.0.0.0 0.255.255.255 any
access-list 105 deny   ip 10.0.0.0 0.255.255.255 any
access-list 105 deny   ip 172.16.0.0 0.15.255.255 any
access-list 105 deny   ip 192.168.0.0 0.0.255.255 any
access-list 105 deny   ip 169.254.0.0 0.0.255.255 any
access-list 105 deny   ip 224.0.0.0 15.255.255.255 any
access-list 105 deny   ip 240.0.0.0 15.255.255.255 any
access-list 105 deny   tcp any any eq 135
access-list 105 deny   tcp any any eq 139
access-list 105 deny   tcp any any eq 443
access-list 105 deny   tcp any any eq 1025
access-list 105 deny   tcp any any eq 4899
access-list 105 deny   tcp any any eq 5554
access-list 105 deny   tcp any any eq 9898
access-list 105 deny   udp any any eq netbios-ns
access-list 105 permit tcp any xxx.xxx.xxx.xxx 0.0.0.7 established
access-list 105 permit udp any xxx.xxx.xxx.xxx 0.0.0.7
access-list 105 permit tcp any xx4.xx4.xx4.xx4 0.0.0.15 established
access-list 105 permit udp any xx4.xx4.xx4.xx4 0.0.0.15
access-list 105 permit icmp any any
access-list 108 permit ip any 192.168.0.0 0.0.255.255
access-list 110 permit ip any any
access-list 143 deny   ip host 217.67.187.40 any
access-list 143 permit ip any any
access-list 150 deny   ip host 217.67.187.40 any
route-map office permit 5
match ip address 104
!
route-map office permit 10
match ip address 3
set ip next-hop xx6.xx6.xx6.xx6
!
route-map office permit 20
match ip address 4
set ip next-hop xx5.xx5.xx5.xx5
!
route-map lan1 permit 10
match ip address 4
!
route-map MAP permit 15
match ip address 108
set interface Loopback0 Ethernet0/0
!
snmp-server engineID local 000000090200000196ACC280
snmp-server community public RO 1
snmp-server packetsize 2048
!
line con 0
transport input none
line aux 0
line vty 0 4
password 7 11051806021C0A0F0B2327
!
ntp server xxx.xxx.xxx.xxx prefer
no scheduler allocate
end